refactor(infra): repurpose asepharyana-hub into infra-only reverse-proxy repo

- Remove app submodules (hub/scraper/tools/llm-api/plugins) — apps are now standalone repos with their own flake.nix + deploy.yml CI - Delete monorepo CI: nix-build.yml matrix, update-submodule.yml, lint, security, flakehub-publish — replaced by infra-only caddy-deploy.yml - Sync Caddyfile.prod with live /etc/caddy/Caddyfile (add wiki. + mcp. blocks) - Prune legacy Docker/Traefik/Dapr/NATS/otel + scripts/root tooling - Docs: rename ADR 0001 superseded, add ADR 0003 (repo rename + split CI), update add-new-app, infra README, troubleshooting
2026-08-27 19:44:10 +07:00
parent 97b635e8c6
commit 0194a865b7
86 changed files with 293 additions and 9655 deletions
@@ -1,49 +1,38 @@
-# ADR 0001: Use a Hub Repository with App Submodules
+# ADR 0001: Infra Repo — Reverse Proxy Config Only (Submodules Removed)

 ## Status

-Accepted
+**Superseded** (2026-08-28) — lihat ADR ini sebagai arsip keputusan awal.

-## Context
+## Context (aslinya)

-The project contains multiple independent application services that share one deployment surface: Docker Compose, Traefik routing, GitHub Actions workflows, and operational documentation.
+Proyek awal memakai `asepharyana-hub` sebagai monorepo: aplikasi di `apps/<service>` sebagai
+git submodule, infra (compose/traefik/dokumen/CI) terpusat di root. Keputusan itu masuk akal
+saat semua service berbagi satu deployment surface.

-The services should be developed and versioned independently, while deployment infrastructure should remain centralized so production routing and compose manifests stay consistent.
+## Decision (aslinya)

-## Decision
+Gunakan `asepharyana-hub` sebagai root hub: app code submodule, infra + CI di root.

-Use `asepharyana-hub` as the root hub repository.
+## Superseded By

- Application code lives under `apps/<service>` as Git submodules.
- Infrastructure lives in the root repo under `infra/`.
- Documentation lives in the root repo under `docs/`.
- CI/CD workflows live in the root repo under `.github/workflows/`.
- Root tooling stays minimal: `package.json`, Prettier, ESLint, Makefile helpers, and deployment scripts.
+Mulai **2026-08-28** repo dirombak:

-Current app submodules:
-
-| Service     | Path           | Remote                                  |
-| ----------- | -------------- | --------------------------------------- |
-| Scraper API | `apps/scraper` | `asepharyana/asepharyana-hub-scraper`   |
+- **Parent `asepharyana-hub` → `asepharyana/infra`** — murni config reverse proxy (Caddy),
+  firewall, systemd drop-ins, docs. CI hanya untuk deploy Caddy.
+- **App repos di-rename & self-contained**: `hub`, `scraper`, `tools`, `llm-api`.
+  Masing-masing punya `flake.nix` + `.github/workflows/deploy.yml` sendiri
+  (`nix build → nix copy → nix-env --profile → systemctl restart`).
+- **Submodule dihapus** — tidak ada lagi pointer submodule / repository_dispatch chain.
+- `update-submodule.yml`, `notify-parent.yml`, matrix `nix-build.yml` dihapus.

 ## Consequences

 ### Positive
-
- Each app can evolve in its own repository.
- The hub pins exact submodule revisions for reproducible deployments.
- Deployment infrastructure remains centralized and easier to audit.
- Root tooling stays lightweight and does not impose one build system on every service.
+- CI tiap app independen: push ke repo app langsung build+deploy, tak perlu 2 hop.
+- Parent kecil & fokus: diff Caddyfile mudah di-audit.
+- Tanpa submodule = tanpa `dubious ownership` / pointer drift / fetchGit pin.

 ### Negative
-
- Developers must understand Git submodule workflows.
- Updating a service requires updating the submodule pointer in the hub repo.
- Cross-service changes require coordinating commits across multiple repositories.
-
-### Mitigations
-
- Keep `.gitmodules` accurate and minimal.
- Use `scripts/sync-submodules.sh` for local checkout consistency.
- Document service-addition steps in `docs/add-new-app.md`.
- Keep GitHub Actions responsible for Docker image builds, compose tag updates, and deployments.
+- Koordinasi cross-repo manual (app + Caddy bila perlu port baru).
+- Repo lama `asepharyana-hub-*` redirect ke nama baru (GitHub auto).
@@ -1,8 +1,12 @@
 # ADR 0002: Production `.env` via GitHub Encrypted Secret

+> **LEGACY (2026-08-28):** Repo `asepharyana-hub` sudah dirombak → `asepharyana/infra`.
+> Workflow lama yang SCP `.env` ke VPS tidak dipakai lagi (deploy app pindah ke repo masing-masing,
+> secrets via Bitwarden `bws-exec`). ADR ini dipertahankan sebagai arsip.
+
 ## Status

-Accepted
+Accepted (archived)

 ## Context

@@ -33,7 +37,7 @@ Container reads $DATABASE_URL, $JWT_SECRET, etc.

 ```bash
 # 1. Read current content from the VPS
-ssh root@45.127.35.244 "cat /root/asepharyana-hub/.env"
+ssh root@45.127.35.244 "cat <VPS app dir, e.g. /home/code/hub>/.env"

 # 2. Pipe updated content to the GitHub secret
 #    (requires gh CLI with repo access)
@@ -43,7 +47,7 @@ cat /path/to/updated-env | gh secret set ENV_FILE_PRODUCTION --repo asepharyana/
 gh workflow run deploy-docker.yml

 # OR apply immediately on the VPS (for hotfix):
-ssh root@45.127.35.244 "sed -i 's|OLD_VALUE|NEW_VALUE|' /root/asepharyana-hub/.env"
+ssh root@45.127.35.244 "sed -i 's|OLD_VALUE|NEW_VALUE|' <VPS app dir, e.g. /home/code/hub>/.env"
 # Then restart affected containers
 ```

@@ -69,7 +73,7 @@ ssh root@45.127.35.244 "sed -i 's|OLD_VALUE|NEW_VALUE|' /root/asepharyana-hub/.e
 The VPS runs a single Docker Compose project named `compose` composed of multiple files:

 ```bash
-/root/asepharyana-hub/infra/compose/
+<VPS app dir, e.g. /home/code/hub>/infra/compose/
 ├── traefik.yml         # Reverse proxy (TLS termination, routing)
 ├── shared.yml          # Redis
 ├── nats.yml            # NATS message broker + JetStream
@@ -99,7 +103,7 @@ docker compose \
 | `SSH_PRIVATE_KEY` | SSH key for VPS access |
 | `VPS_HOST` | `45.127.35.244` |
 | `VPS_USER` | `root` |
-| `VPS_TARGET_DIR` | `/root/asepharyana-hub` |
+| `VPS_TARGET_DIR` | `<VPS app dir, e.g. /home/code/hub>` |
 | `ENV_FILE_PRODUCTION` | Full `.env` content for production |

 ## Consequences
@@ -0,0 +1,47 @@
+# ADR 0003: Rename Repositori & Pisahkan CI per Aplikasi
+
+## Status
+
+Accepted (2026-08-28)
+
+## Context
+
+Monorepo `asepharyana-hub` (app submodule + infra + CI terpusat) punya kelemahan:
+- CI build+deploy semua app menyatu di parent (`nix-build.yml` matrix) — setiap push app
+  butuh 2 hop (notify-parent → update-submodule → nix-build), rawan drift pointer.
+- Nama `asepharyana-hub` ambigu (parent & app prefix sama), dan submodule menambah kompleksitas.
+
+## Decision
+
+Rombak total:
+
+| Lama | Baru | Peran |
+|------|------|-------|
+| `asepharyana-hub` | `asepharyana/infra` | Reverse proxy (Caddy) + firewall + systemd + docs. CI: caddy-deploy saja. |
+| `asepharyana-hub-hub` | `asepharyana/hub` | Portfolio SPA. CI mandiri (deploy.yml). |
+| `asepharyana-hub-scraper` | `asepharyana/scraper` | Rust scraper API. CI mandiri. |
+| `asepharyana-hub-tools` | `asepharyana/tools` | Tools stack (gateway/workers/frontend). CI mandiri. |
+| `asepharyana-hub-llm-api` | `asepharyana/llm-api` | Rust LLM API. CI mandiri. |
+| `asepharyana-hub-guide` | `asepharyana/hub-guide` | (tidak di-root; plugin guide — diarsipkan) |
+
+Setiap app repo mendapat:
+- `flake.nix` (derivasi build sendiri, tanpa fetchGit submodule)
+- `.github/workflows/deploy.yml` (nix build → nix copy → nix-env --profile → systemctl restart)
+- Secret `SSH_PRIVATE_KEY`, `VPS_HOST`, `VPS_USER`
+
+Parent `infra` mendapat:
+- Hapus semua submodule + `update-submodule.yml` + matrix `nix-build.yml`
+- `.github/workflows/caddy-deploy.yml` (sync Caddyfile → reload → verify)
+- Docs diarahkan ulang.
+
+## Consequences
+
+- **Positif**: CI per-app independen & cepat; parent kecil; tanpa submodule = tanpa fetchGit pin
+  / dubious-ownership / pointer churn. Rename GitHub auto-redirect URL lama.
+- **Negatif**: koordinasi manual bila app butuh port baru di Caddy; workflow lama di
+  downstream (skill/cron) perlu update referensi.
+
+## Referensi
+
+- `docs/add-new-app.md` — proses menambah service baru
+- `infra/caddy/Caddyfile.prod` — pola site block